Privacy policy

What is stored

Passwordless sign-in uses your email address through Supabase Auth. After sign-in, the app stores your chosen display name in your private profile. Your email is used for sign-in and recovery and is not shown to group members.

When you use shared groups, the service stores group names, currency, participant names, memberships, expenses, repayments, exact amounts, revisions, removals, corrections, balances, audit history, operation records, and timestamps. A shared group may retain the stable label Deleted user in its history after an account is deleted.

The app keeps an account-scoped SQLite cache on the device. It can contain the group and ledger data above, safe actor display data, pending offline changes, retry state, conflict snapshots, and sync status. The authentication session is stored separately using the platform secure-storage facility.

Invitations and exports

Invitation codes are generated for a named participant slot. The server stores a digest of the code rather than the raw code. A newly created code is kept only in the current invite screen state and is not placed in the group cache or an export.

CSV and JSON exports are prepared only when you choose a share action. They are written to the device cache temporarily and deleted after the share action completes or fails. The exports do not contain email addresses, session data, one-time codes, invitation codes, raw tokens, service keys, or database credentials.

Why the data is used

The data is used to sign you in, recover your account, show your profile, create and sync shared groups, calculate balances, preserve correction history, deliver offline changes, prepare exports you request, and perform the group and account deletion actions available in the app.

Supabase provides the configured authentication, database, and realtime service. No advertising, analytics, push-notification, contact-book, location, camera, microphone, photo-library, bank, card, or payment-provider feature is implemented in this release.

Leaving, deletion, and retention

Shared group data is retained while the group exists. Leaving a group removes your active membership and clears that group from the leaving device; it does not rewrite the shared ledger. The owner can delete a group after confirmation, which removes its shared data for all members after their next refresh.

Account deletion is available in the app under Account & privacy when you have an online authenticated session. An owner must first transfer ownership or delete active groups. After the server operation succeeds, the private profile and authentication record are removed, outstanding invitations created by the account are removed, memberships are made inactive, and the shared history retains the Deleted user label. The device then clears its local cache, profile, session, pending changes, and conflict state.

Security and choices

Hosted app traffic is configured to use HTTPS. Access to shared rows is limited by the group membership rules implemented in the backend, and session material is kept in platform secure storage on native devices. Local development may use a local HTTP Supabase endpoint and is not a production configuration.

You can stop using the app, sign out, leave groups, export groups, delete groups as an owner, or delete your account from the available app controls. For help with the in-app flow, see Support.